AI-200 Exam Questions & Answers

The correct answer is to use the Service Bus dead-letter queue for messages that repeatedly fail and configure the Function binding retry policy for transient errors. The dead-letter queue automatically captures messages that exceed max delivery attempts, preventing them from blocking the pipeline. The Function binding retry policy handles transient failures gracefully.

Ignoring the dead-letter queue risks messages remaining in the subscription indefinitely. Moving messages to blob storage is a manual workaround that does not provide the automatic handling that dead-letter queues offer. Polling instead of event-driven processing defeats the purpose of using Service Bus and increases latency and cost.

To validate that a replica is ready to handle incoming web requests:

Implement a liveness probe (or readiness probe) - Azure Container Apps supports health checks that monitor container readiness:

• Readiness Probe - Checks if the container is ready to accept traffic. Returns to load balancer whether the replica should receive traffic
• Liveness Probe - Checks if the container is still running and healthy

For a web request trigger that must always be available, configure a readiness probe on an HTTP endpoint that returns 200 OK only when the service is fully initialized and ready. This ensures Container Apps only routes incoming requests to healthy replicas, maintaining availability for the orders processing service.

For KEDA custom scale rules monitoring Azure Storage queue messages:

1. queueLength - This parameter defines the target queue depth per replica. For example, if set to 10, KEDA scales to maintain an average of 10 messages per replica. If 100 messages exist, it scales to 10 replicas
2. activationThreshold - This parameter defines the queue depth at which scaling begins. For example, if set to 5, the service doesn't scale up until the queue reaches 5 messages. This prevents unnecessary scaling for small message volumes

These two values together control when scaling activates and how aggressively it scales, allowing fine-tuned autoscaling behavior based on queue depth.

To implement secure access to Azure Key Vault for the API:

1. Use Managed Identity for authentication - Managed Identity (system-assigned or user-assigned) eliminates the need to store credentials in configuration files. The identity is managed by Azure and credentials are issued automatically
2. Create identities with minimal permissions - Use role-based access control (RBAC) to grant only the specific permission needed: 'Get' access to secrets. This minimizes blast radius if the identity is compromised

This combination ensures the API authenticates without stored credentials, operates with least-privilege access, and limits exposure in case of compromise. Avoid using connection strings or shared keys stored in configuration.

To reduce risk of serving outdated data while minimizing cache management overhead:

Implement time-based expiration (TTL) with Redis - Set an appropriate Time-To-Live on cached entries. This approach:

• Reduces outdated data risk - Entries automatically expire after the TTL period, ensuring stale data isn't served indefinitely
• Minimizes management overhead - No need for manual cache invalidation logic or event-based invalidation. Redis automatically removes expired entries
• Is simple to implement - Use Redis EXPIRE or set EX parameter during SET operations

For an AI inference API, a TTL of 5-15 minutes typically balances freshness with cache hit rates and reduces complexity compared to event-driven invalidation strategies.